SC-200 Guided Course

This guided course is for learners who want a structured path through Microsoft Security Operations Analyst. Start with ordered lessons, answer exam-style questions, review explanations, and use Practice Mode afterward to test retention.

• Follow an ordered SC-200 course path instead of starting with random questions.
• Use source-backed scenarios to connect concepts to practical administration decisions.
• Review why the correct answer fits and why the distractors do not.
• Track course progress on this device and return to the next lesson later.
• Move from guided learning into Practice Mode when you are ready to check retention and speed.

The full course continues in order. These early lessons are crawlable here so you can see the shape of the path before the interactive course loads.

1. Lesson 1: Configure Defender XDR notifications, tuning, suppression, and correlation
   Lesson 1 uses Configure Defender XDR notifications, tuning, suppression, and correlation to connect Manage a security operations environment with Configure Defender XDR notifications, tuning, suppression, and correlation.
2. Lesson 2: Investigate and manage Microsoft Defender XDR incidents and complex attacks
   Lesson 2 uses Investigate and manage Microsoft Defender XDR incidents and complex attacks to connect Respond to security incidents with Investigate and manage Microsoft Defender XDR incidents and complex attacks.
3. Lesson 3: Select tables and apply KQL operators for threat hunting
   Lesson 3 uses Select tables and apply KQL operators for threat hunting to connect Perform threat hunting with Select tables and apply KQL operators for threat hunting.
4. Lesson 4: Configure Microsoft Defender for Endpoint advanced features, rules, collection, and security policies
   Lesson 4 uses Configure Microsoft Defender for Endpoint advanced features, rules, collection, and security policies to connect Manage a security operations environment with Configure Microsoft Defender for Endpoint advanced features, rules, collection, and security policies.
5. Lesson 5: Investigate Defender for Office 365 and Microsoft Purview threats
   Lesson 5 uses Investigate Defender for Office 365 and Microsoft Purview threats to connect Respond to security incidents with Investigate Defender for Office 365 and Microsoft Purview threats.
6. Lesson 6: Manage automated investigation, response, and automatic attack disruption
   Lesson 6 uses Manage automated investigation, response, and automatic attack disruption to connect Manage a security operations environment with Manage automated investigation, response, and automatic attack disruption.
7. Lesson 7: Create Advanced Hunting queries and interpret threat analytics
   Lesson 7 uses Create Advanced Hunting queries and interpret threat analytics to connect Perform threat hunting with Create Advanced Hunting queries and interpret threat analytics.
8. Lesson 8: Investigate Defender for Cloud workload and Defender for Cloud Apps alerts
   Lesson 8 uses Investigate Defender for Cloud workload and Defender for Cloud Apps alerts to connect Respond to security incidents with Investigate Defender for Cloud workload and Defender for Cloud Apps alerts.
9. Lesson 9: Create and configure Microsoft Sentinel automation rules
   Lesson 9 uses Create and configure Microsoft Sentinel automation rules to connect Manage a security operations environment with Create and configure Microsoft Sentinel automation rules.
10. Lesson 10: Investigate compromised identities with Entra ID Protection and Defender for Identity
    Lesson 10 uses Investigate compromised identities with Entra ID Protection and Defender for Identity to connect Respond to security incidents with Investigate compromised identities with Entra ID Protection and Defender for Identity.